Author: Andrew Appel
Because voting machines contain computers that can be hacked to make them cheat, “Elections should be conducted with human-readable paper ballots. These may be marked by hand or by machine (using a ballot-marking device); they may be counted by hand or by machine (using an optical scanner). Recounts and audits should be conducted by human inspection of the human-readable portion of the paper ballots.”
Ballot-marking devices (BMD) contain computers too, and those can also be hacked to make them cheat. But the principle of voter verifiability is that when the BMD prints out a summary card of the voter’s choices, which the voter can hold in hand before depositing it for scanning and counting, then the voter has verified the printout that can later be recounted by human inspection.
But really? As a practical matter, do voters verify their BMD-printed ballot cards, and are they even capable of it? Until now, there hasn’t been much scientific research on that question.
A new study by Richard DeMillo, Robert Kadel, and Marilyn Marks now answers that question with hard evidence:
- In a real polling place, half the voters don’t inspect their ballot cards, and the other half inspect for an average of 3.9 seconds (for a ballot with 18 contests!).
- When asked, immediately after depositing their ballot, to review an unvoted copy of the ballot they just voted on, most won’t detect that the wrong contests are presented, or that some are missing.
This can be seen as a refutation of Ballot-Marking Devices as a concept. Since we cannot trust a BMD to accurately mark the ballot (because it may be hacked), and we cannot trust the voter to accurately review the paper ballot (or even to review it at all), what we can most trust is an optical-scan ballot marked by the voter, with a pen. Although optical-scan ballots aren’t perfect either, that’s the best option we have to ensure that the voter’s choices are accurately recorded on the paper that will be used in a recount or random audit.
Here’s how DeMillo et al. measured voter verification.
- In Gatlinburg, Tennessee they observed a polling place during a primary election in May 2018. There were several BMDs (ExpressVote), where voters produced their ballot card using a touchscreen, and a single optical scanner where voters then deposited their ballot cards. The observers were not close enough to see the voters’ choices, but close enough to see the voter’s behavior. 87 voters were observed, of whom 47% did not look at the ballot card at all before depositing it, and 53% reviewed the card for an average of 3.9 seconds. There were 18 contests on the ballot.
- Near Chattanooga, Tennessee during an August 2018 primary election, they conducted a kind of “exit poll”, at the required distance of 150 feet from the polling location. The voter was asked to review an unvoted optical-scan sample ballot, and was asked, “Is this the ballot you just voted on?”
-
- When the voter was given the correct ballot, 86% recognized as the right ballot, and 14% thought it was different from what they voted.
- When the voter was given a subtly incorrect ballot (completely different set of candidates either for House of Representatives, for County Commission, or for School Board), 56% wrongly said that this was the ballot they voted, and 44% said there was something wrong.
This strongly suggests that it is possible for a hacked BMD to cheat in just one contest (for Congress, perhaps, when there is a presidential race on the top of the ticket; or state legislator) and most voters won’t notice. Those who do notice can ask to try again on the touchscreen, and a cleverly hacked BMD will make sure not to cheat the same voter again.
In summary, “Can voters effectively verify their machine-marked ballots?” No. “Do voters try to verify their machine-marked ballots?” No.
As DeMillo et al. write, “Given the extent to which test subjects are known . . . to agree with an authoritative-sounding description of events that never happened, the use of recall in [BMD-marked ballots] deserves further evaluation. . . . The [BMD-marked ballot] is not a reliable document for post-election audits.”
And therefore, voters should mark optical-scan bubbles on their paper ballot, with a pen.
References
What Voters are Asked to Verify Affects Ballot Verification: A Quantitative Analysis of Voters’ Memories of Their Ballots, by Richard DeMillo, Robert Kadel, and Marilyn Marks, SSRN abstract 3292208, November 2018.
There is also related work on whether voters notice changes on the “review screens” of touchscreen DRE voting machines. That’s not quite the same thing, because a hacked DRE can also cheat on its review screen. Still, the related work also finds that voters are not very good at noticing errors:
The Usability of Electronic Voting Machines and How Votes Can Be Changed Without Detection, by Sarah P. Everett, PhD Thesis, Rice University, 2007.
Now do voters notice review screen anomalies? a look at voting system usability. By Bryan A. Campbell and Michael D. Byrne, in 2009 USENIX/ACCURATE Electronic Voting Technology Workshop/Workshop on Trustworthy Elections (EVT/WOTE) (Montreal, Canada, 2009).
Broken Ballots: Will Your Vote Count?, (section 5.6) by Douglas W. Jones and Barbara Simons, CSLI Publications, 2012.
The Vote-o-graph: Experiments with Touch Screen Voting, by Douglas W. Jones, 2011.
Full Article: Why voters should mark ballots by hand.